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SUMMARY 

Erroneous measurements in multisensor navigation systems must be detected and 
isolated. A recursive estimator can find fast growing errors; a least squares batch 
estimator can find slow growing errors. This process is called fault detection. A 
protection radius can be calculated as a function of time for a given location. This 
protection radius can be used to guarantee the integrity of the navigation data. Fault 
isolation can be accomplished using either a snapshot method or by examining the 
history of the fault detection statistics. 


BACKGROUND 

The objective of fault detection and isolation is to use inconsistencies in 
redundant sensor measurement data to detect and isolate sensor malfunctions. One 
criterion for determining whether a system can be used as a sole means of navigation is 
the percentage of time that the position error is greater than a given maximum. If a 
given single measurement is in error, it will cause the navigation solution to be in error, 
possibly outside the allowable error threshold. Outside sources may not be able to 
broadcast in a timely manner that the signal is in error. For instance, if a single GPS 
satellite starts to broadcast erroneous signals, it could be from 15 minutes to several 
hours before this is broadcast in the satellite health data. Therefore, it is imperative for 
Fault Detection and Isolation (FDI) algorithms to be able to detect and isolate 
instrument errors using only data from the instruments themselves. 

Previous work in FDI has mainly centered around inertial navigation systems 
(refs. 2 through 4). However, FDI can be implemented in any multisensor navigation 
system with redundant measurements. Current work is focusing on satellite navigation 
using the Global Positioning System (GPS), along with hybrid systems such as GPS 
integrated with the Long Range Navigation System (Loran-C) or GPS integrated with an 
Inertial Reference System (IRS) (ref. 6). FDI used specifically with GPS is also known 
as Receiver Autonomous Integrity Monitoring (RAIM) (ref. 7). 

Kalman filters are becoming standard as part of the navigation solution in most 
GPS receivers. The Kalman filter can look at the difference between a predicted state 
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estimate and the actual measured state, and declare a fault if this difference is too large. 
This works well for detecting step errors or fast growing ramp errors. However, this will 
not detect a slow growing ramp error, such as might be caused by a GPS satellite clock 
drift. To detect slow growing errors, the Kalman filter algorithm must be run in parallel 
with a least squares estimator algorithm. The least- squares algorithm requires at least 
one redundant measurement for fault detection, and at least two redundant 
measurements for isolation. 


PARITY SPACE AND ESTIMATION SPACE 

Estimation space contains the actual horizontal measurement error and the alarm 
threshold for a given positioning error. However, actual positions and actual errors 
cannot be known given that the only measurement data is coming from imperfect 
sensors. Therefore, the work of detecting and isolating errors is done in parity space. 
Parity space is a mathematical tool where measurement noise and biases are used to 
create a parity vector. The parity vector determines a detection statistic, d, which is 
compared to a detection threshold, T D , in order to determine whether an alarm 
condition exists. The parity vector is also used as a tool for fault isolation. 

Errors and biases in parity space and estimation space are related, but it is not a 
one to one correspondence. The exact correspondence will be determined by 
measurement geometries. For instance, with a good geometry, a large measurement 
error (parity space) will result in only a small position error (estimation space). The 
reverse can also be true. Figure 1 illustrates two different slow growing ramp errors 
plotted in parity space versus estimation space. In case I, the detection threshold is 
crossed before the alarm threshold is reached, yielding a false alarm. As the error 
continues to grow, the alarm threshold is crossed, turning it into a correct fault 
detection. In case II, the alarm threshold is crossed before the detection threshold is 
reached, resulting in a missed detection. As the error continues to grow, the detection 
threshold is crossed, turning it into a correct fault detection. An ideal algorithm would 
minimize both the number of false alarms and missed detections. 


LEAST SQUARES ESTIMATOR ALGORITHM 


In a least-squares approach to fault detection, the relationship between the 
measurements and the user state (position) is given by: 

X = H£ (1) 


where: y = measurement vector (n-by-1) 

H = data matrix (n-by-m) 

6 = user state vector (m-by-1) 

y is a vector containing n measurements, one from each instrument. In the case 
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of using only GPS satellites, it would consist of the pseudoranges. B is the m-element 
user state vector, consisting of the user position coordinates and other navigation state 
elements such as clock offset with respect to GPS time. H is an n-by-m matrix which 
relates the measurements to the user states. 

There are three possible cases: 

1) n < m : Underdetermined system 

2) n = m : Exactly determined system 

3) n > m : Overdetermined system 

In the underdetermined case, a navigation solution is not possible. In the 
exactly-determined case, a navigation solution is possible, but fault detection is not. 

Algorithms for managing the redundant measurements in an overdetermined 
system form the basis of fault detection. A parity equation can be derived from 
equation (1), starting with a mathematical manipulation called the QR factorization on 
the data matrix H (ref. 4): 

H = QR ( 2 ) 

H is factored into an n-by-n orthogonal matrix Q (Q T Q = I) and an n-by-m upper 
triangular matrix R. R contains (n-m) rows of zeros along the bottom, due to the n-m 
redundant measurements in H. Substituting QR for H in equation (1) gives: 

x = QR£ 

Q T y = Q T QR£ ( 3 ) 

Q T y = R £. 


Next partition R into an m-by-m upper triangular matrix U and (n-m) rows of zeros, 
denoted by 0. Similarly, partition Q T into Q! (m-by-n) and Q 2 ((n-m)-by-n rows). 
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The least squares navigation state solution is: 

Si = U-^y 


( 4 ) 


( 5 ) 


The parity equation is: 
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Q 2 x = 0 


( 6 ) 


The measurement vector y contains noise (e) and measurement biases (b). If y is 
replaced by (y - e - b), the 0 in equation (6) can be replaced by the parity vector p. 

p = Q 2 x - Q 2 e - Q 2 b 
P = -Q 2 £ - Q 2 b 


Thus, a parity vector will be determined by the noise and bias errors. From the parity 
vector, it can be determined which instrument is in error and whether or not to raise an 
alarm. 


PARITY SPACE AND DETECTION PROBABILITIES 

Consider a situation with one redundant measurement. In this case, the parity 
vector will be reduced to a scalar, and the detection statistic reduces to the absolute 
value of the scalar. In the case where no measurement bias exists, figure 2 shows the 
distribution of the parity scalar. Since there is no bias error, position error is definitely 
under the alarm threshold and the system is either in normal operation or a false alarm 
exists. The probability of a false alarm (P FA ) is obtained by integrating the areas outside 
of T d . For noise having a normal distribution (generally a good assumption), this 
integral is a standard Gaussian function. 

Figure 3 illustrates the case where a large measurement bias exists, making the 
position error larger than the alarm threshold. In this case the system is either correctly 
detecting a fault or a missed detection is present. The probability of a missed detection 
(P MD ) is the integral of the area inside T D . Again, if Gaussian noise is assumed, this is a 
standard Gaussian function. 


PROTECTION RADIUS 

The above example uses a detection threshold, measurement noise, and 
measurement bias error as parameters to find P FA and P MD . Accuracy requirements are 
stated in a form like "the probability of exceeding 100 meters accuracy is no greater than 
0.05". In order to compare FDI results with such specifications, it helps to rearrange the 
procedure. This means using the above parameters to determine the protection radius, 
which is the largest horizontal position error that is guaranteed to be detected with the 
required probabilities of alarm and missed detection. If all parameters are kept 
constant, the protection radius will vary only as a function of satellite geometry. 

One way of finding the protection radius is to use all satellites in view and go 
through the full parity space/parity vector derivation. Another possibility is to take only 
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the best 5 satellites (geometry wise) in view and use only those for the calculation. The 
second method has the advantage that, since there is only one redundant measurement, 
the parity vector is reduced to a scalar and the algorithm is simpler. Also, a receiver 
would only be required to track five satellites. 

A comparison of the two methods is shown in figures 4 and 5. These are plots of 
the protection radius as satellite positions change over one day at a single location. 

Many different locations were tested (with simulated satellite data) worldwide; figure 4 
shows the best case result, figure 5 the worst case. As expected, the all-in-view method 
always gives a better result than the best-of-five. 


FAULT ISOLATION 

In the case with one redundant measurement, faults can be detected but not 
isolated. Isolation requires two or more redundant measurements. Consider the case of 
two redundant measurements. The parity vector now has two elements, making parity 
space two dimensional. Each measurement in parity space can be represented by an axis 
extended radially outward from the origin, in both (positive and negative) directions. 

The exact orientation of each axis depends on satellite geometry; thus each axis will 
rotate over time. The basic premise of fault isolation in parity space is that a bias error 
in measurement i will lie along measurement axis i in parity space. A growing bias error 
will move outward along a line parallel to the measurement axis. 

Figure 6 illustrates a case of flight test data consisting of 4 GPS and 3 Loran-C 
measurements. There are 5 unknowns, which are the 3 user coordinates, the user clock 
offset from GPS time, and the user clock offset from Loran-C time. This leaves 2 
redundant measurements, so parity space is 2 dimensional and it contains 7 axes, 1 for 
each measurement. The irregular plots are the traces over time of the end of the parity 
vector, as a slow growing ramp error is being artificially injected into each of the 
measurements. Each growing error runs parallel to the parity axis for that measurement. 
Measurement 2 seems to violate this rule, but what could not be shown on one graph is 
that axis 2 rotated significantly (as compared to the others) over the course of the data 
run; thus, the plot for instrument 2 ends up curved as it attempts to stay parallel with 
the axis as it rotates. Also note that the actual unaltered measurements contained a bias 
on instrument 4, as shown by the tracks originating a small distance out on axis 4. 

The simplest method for isolating the faulty instrument is the "snapshot" batch 
estimator. This method, upon detecting a fault, looks for the parity axis that is closest to 
the parity vector, and assumes that the measurement belonging to that axis is faulty. 

The history method, on the other hand, determines which axis is parallel to the track 
traced out by the parity vector over time. The history method is more accurate, but 
requires more computation, has a built in delay and must restart if any measurements 
are lost. 
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CONCLUSIONS 


A fault detection algorithm for a multisensor navigation system has been 
presented. A protection radius has been calculated using the all-in-view and the best-of- 
five methods, with the all-in-view proving significantly superior. Fault isolation methods 
have also been shown, using both snapshot and continuous tracing methods. Efforts 
continue on exploring the tradeoffs between algorithms, with the goal of determining 
whether minimum navigation system requirements can be satisfied using fault detection 
and isolation. 
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Figure 1. Two slowly growing measurement errors plotted in parity space 
versus estimation space. 
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Figure 2. Probability density function for the parity scalar in the absence of a 
measurement bias error. 



Figure 3. Probability density function for the parity scalar in the presence of a 
measurement bias error. 
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Figure 4. Best case protection radius (location: S3 W80). 



Figure 5. 


Worst case protection radius (location: N36 E140). 








